Declare support for Matrix v1.12 and v1.13

[erikjohnston]

I think we support all the necessary stuff, but we should double check the changelogs:

• https://spec.matrix.org/v1.13/changelog/v1.12/
• https://spec.matrix.org/v1.13/changelog/v1.13/

[Half-Shot]

I had a look myself to try and move this along, there were a few things I was uncertain about but the majority looks stabilized.

(I've skipped over anything non-applicable to Servers)

v1.12:

• Deprecate the server_name query parameter on POST /_matrix/client/v3/join/{roomIdOrAlias} and POST /_matrix/client/v3/knock/{roomIdOrAlias}, as per MSC4156. (#1933)
• Remove references to device-specific push rules. (#1842)
• Add 403 responses on GET /_matrix/client/v3/profile/{userId}/avatar_url and GET /_matrix/client/v3/profile/{userId}/displayname, as per MSC4170. (#1867)
• Add via query parameter on POST /_matrix/client/v3/join/{roomIdOrAlias} and POST /_matrix/client/v3/knock/{roomIdOrAlias}, as per MSC4156. (#1933)
• Add account locking, as per MSC3939. (#1934)
• Guest accounts can now download/thumbnail media from the new authenticated endpoints, as per MSC4189. (#1959)
• Add 403 response on GET /_matrix/federation/v1/query/profile, as per MSC4170. (#1867)
• Remove origin field from PDU example because it doesn’t exist in the schema anymore. (#1918)
  • PR: Stop sending or processing the origin field in PDUs #18418

v1.13:

• Add POST /_matrix/client/v3/rooms/{roomId}/report, as per MSC4151. (#1938, #2028)
• Add new M_USER_SUSPENDED error code behaviour, as per MSC3823. (#2014)
• Clarify the allowed HTTP methods in CORS responses, as per MSC4138. (#1995, #2011)
  • Lacks PATCH?

    synapse/synapse/http/server.py

    Line 912 in 068e22b

    if request.path is not None and (

• The reason parameter in POST /_matrix/client/v3/rooms/{roomId}/report/{eventId} can be omitted instead of left blank, as per MSC2414. (#1938)
• Make ACLs apply to EDUs, as per MSC4163. (#2004)
  • I'm not sure they do?

    synapse/synapse/federation/federation_server.py

    Lines 541 to 578 in 2277df2

    	async def _handle_edus_in_txn(self, origin: str, transaction: Transaction) -> None:
    	"""Process the EDUs in a received transaction."""
    	async def _process_edu(edu_dict: JsonDict) -> None:
    	received_edus_counter.inc()
    	edu = Edu(
    	origin=origin,
    	destination=self.server_name,
    	edu_type=edu_dict["edu_type"],
    	content=edu_dict["content"],
    	)
    	try:
    	await self.registry.on_edu(edu.edu_type, origin, edu.content)
    	except Exception:
    	# If there was an error handling the EDU, we must reject the
    	# transaction.
    	#
    	# Some EDU types (notably, to-device messages) are, despite their name,
    	# expected to be reliable; if we weren't able to do something with it,
    	# we have to tell the sender that, and the only way the protocol gives
    	# us to do so is by sending an HTTP error back on the transaction.
    	#
    	# We log the exception now, and then raise a new SynapseError to cause
    	# the transaction to be failed.
    	logger.exception("Error handling EDU of type %s", edu.edu_type)
    	raise SynapseError(500, f"Error handing EDU of type {edu.edu_type}")
    	# TODO: if the first EDU fails, we should probably abort the whole
    	# thing rather than carrying on with the rest of them. That would
    	# probably be best done inside `concurrently_execute`.
    	await concurrently_execute(
    	_process_edu,
    	transaction.edus,
    	TRANSACTION_CONCURRENCY_LIMIT,
    	)

• Add 403 error response to /_matrix/federation/v1/state_ids/{roomId}. (#1926)

[anoadragon453]

Remove origin field from PDU example

Synapse appears to still include origin in events, but as this issue and this comment suggests, nothing uses it nor does Synapse enforce its existence. So I think it's fine to remove all usages from Synapse.

Clarify the allowed HTTP methods in CORS responses

The spec states that only homeservers that listen for additional methods need add them here. Synapse does not accept PATCH for any endpoints, and thus it need not be specified in Access-Control-Allow-Methods.

Make ACLs apply to EDUs

From looking at the code, I don't believe ACLs are applied to them yet, no. The MSC states that its only implementation was in Conduwuit.